[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242416 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, April 17, 2026 12:52:04 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242416 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242416

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  51618300      172061        14.3%   160.119.76.19
  34914000      116380         9.6%   160.119.76.18
  27629400       92098         7.6%   160.119.76.16
  21502200       71674         5.9%   160.119.76.25
  19898400       66328         5.5%   160.119.76.23
  18559800       61866         5.1%   132.68.130.55
  16936800       56456         4.7%   160.119.76.26
  11186400       37288         3.1%   20.209.177.33
   8640600       28802         2.4%    2.16.168.113
   8195100       27317         2.3%    2.16.168.122

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  18627300       62091         5.1%       172.64.66.1
  17998200       59994         5.0%   128.139.225.242
  11186700       37289         3.1%       132.70.19.4
   8640600       28802         2.4%      132.71.97.16
   8197200       27324         2.3%      132.71.97.34
   4351800       14506         1.2%     128.139.200.4
   3662100       12207         1.0%     128.139.200.5
   3374400       11248         0.9%     132.66.253.82
   3140400       10468         0.9%      192.114.5.10
   3012600       10042         0.8%     192.114.52.14

Top-10 Possible Targets by Bytes:
         Src IP   Src Port            Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
                                 172.64.66.1        443     26651385900
                                 172.64.66.1                26651385900
  132.68.130.55                                     443     26646698700
  132.68.130.55                                             26646698700
                             128.139.225.242                22251388200
                       443   128.139.225.242                17748827100
   2.16.168.113        443                                  12902654100
   2.16.168.113                                   63953     12902654100
   2.16.168.113                                             12902654100
                       443      132.71.97.16                12902654100

Metric Info:
2M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-16 21:51:50
End Time: ongoing

First Event Seen: 2026-04-16 21:49:00
Last Event Seen: 2026-04-16 21:50:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242416/